1

The command ps aux | grep ] will list all the running kernel threads (the kernel threads that are crated by the kernel, and the kernel threads that are crated by someone else).

Is there a way to list the kernel threads that are created by the kernel only?

Improve this question

1 Answer 1

Reset to default
2

Kernel threads are always created by the kernel, and they’re always in process group 0, so you can filter on that:

ps -e -o pid,ppid,pgid,args | awk '$3 == 0'

(There doesn’t seem to be a way of filtering on process group id in ps; in theory one could filter on session 0 but ps doesn’t like that.)

You can also look for processes whose parent is kthreadd, the kernel thread dæmon:

ps --pid 2 --ppid 2 -o pid,ppid,pgid,args

(including pid 2 and its children).

Improve this answer
3
  • "Kernel threads are always created by the kernel" By "Kernel" do you mean the kernel and the kernel modules or just the kernel by itself (because I think kthread_create() is used by kernel modules to create kernel threads)?
    – user343344
    Commented Mar 25, 2019 at 17:26
  • Yes, both the kernel and kernel modules; I tend not to distinguish them since most modules can be built in, and once loaded, modules are effectively part of the kernel.
    – Stephen Kitt
    Commented Mar 25, 2019 at 17:50
  • You could perhaps distinguish between threads started by the “core” kernel from those started by modules by looking at etimes in ps.
    – Stephen Kitt
    Commented Mar 25, 2019 at 17:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .